Vulnerability · Published Apr 17, 2024 · Assigned by tibco
CVE-2024-3323Reflected Cross Site Scripting (XSS) vulnerability
High 8.3
In plain English
A high-severity cross-site scripting in JasperReports Server from TIBCO. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities).
Severity (CVSS 3.1)8.3High
Exploit odds (30 days)0.4%top 61.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Cross Site Scripting in UI Request/Response Validation in TIBCO JasperReports Server 8.0.4 and 8.2.0 allows allows for the injection of malicious executable scripts into the code of a trusted application that may lead to stealing the user's active session cookie via sending malicious link, enticing the user to interact.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| TIBCO | JasperReports Server | 8.0 – before 8.0.48.2 – before 8.2.0 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:L